What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Auto.search.msn.com, Ieautosearch, Etc

22 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
OK, try this. Open the Killbox again, select the Delete on reboot option. In the 'Full Path of File to Delete' box, copy and paste the following, clicking the 'Delete File' button (red circle with a white X) after pasting:

C:\WINNT\system32\wibobo.exe

It will prompt you to reboot, press the NO button. Instead, copy and paste the following and click the 'Delete File' button again:

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\huipip.exe

It will prompt you to reboot, press the NO button again and repeat for the following:

C:\WINNT\system32\d4j02e1mgh.dll

When prompted this time, click yhe YES button.

With only HJT running, have it fix:

O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O4 - HKLM\..\Run: [Narrator] C:\WINNT\system32\wibobo.exe
O4 - Global Startup: huipip.exe

Reboot again, rescan and post a new log together with a new Silent Runners log.
Post #17
Logfile of HijackThis v1.98.2 Scan saved at 6:50:31 AM, on 12/7/2004 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe c:\winnt\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\System32\termsrv.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\System32\msdtc.exe C:\Program Files\Symantec\pcAnywhere\awhost32.exe C:\WINNT\System32\CTsvcCDA.EXE C:\WINNT\System32\svchost.exe C:\Program Files\Expertcity\GoToMyPC\g2svc.exe C:\Program Files\Expertcity\GoToMyPC\g2comm.exe C:\WINNT\System32\llssrv.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\system32\stisvc.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\System32\MsPMSPSv.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\inetsrv\inetinfo.exe C:\WINNT\system32\Dfssvc.exe C:\WINNT\System32\svchost.exe C:\Program Files\Expertcity\GoToMyPC\g2tray.exe C:\Program Files\Expertcity\GoToMyPC\g2mainh.exe C:\Program Files\Expertcity\GoToMyPC\g2host.exe c:\winnt\system32\rundll32.exe C:\WINNT\Explorer.EXE C:\WINNT\system32\wicoco.exe C:\Program Files\SED\SED.exe C:\Program Files\Babylon\Babylon.exe C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe C:\Program Files\Trillian\trillian.exe C:\Program Files\Expertcity\GoToMyPC\g2printh.exe C:\Thanksgiving97extra\HijackThis.exe O4 - HKLM\..\Run: [PrinTray] C:\WINNT\system32\spool\DRIVERS\W32X86\2\printray.exe O4 - HKLM\..\Run: [GoToMyPC] C:\Program Files\Expertcity\GoToMyPC\g2svc.exe -logon O4 - HKCU\..\Run: [Babylon Translator] C:\Program Files\Babylon\Babylon.exe O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{314CDDDA-723C-45B2-BBE2-B55E0351E972}: NameServer = 151.203.0.84,151.203.0.85 "Silent Runners.vbs", revision 27, launched at: 06:57 Operating System: Windows 2000 Startup items buried in registry: ——————————— HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ "Babylon Translator" = "C:\Program Files\Babylon\Babylon.exe" ["Babylon Ltd."] "Creative Detector" = "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R" ["Creative Technology Ltd"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ "PrinTray" = "C:\WINNT\system32\spool\DRIVERS\W32X86\2\printray.exe" ["Lexmark"] "GoToMyPC" = "C:\Program Files\Expertcity\GoToMyPC\g2svc.exe -logon" ["Expertcity"] "Narrator" = "C:\WINNT\system32\wicoco.exe" [null data] HKLM\Software\Microsoft\Active Setup\Installed Components\ ">{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\(Default)" = "" \StubPath = "C:\WINNT\inf\unregmp2.exe /ShowWMP" [MS] "{5945c046-1e7d-11d1-bc44-00c04fd912be}\(Default)" = "MSN Messenger 4.6" \StubPath = "rundll32.exe advpack.dll,LaunchINFSection C:\WINNT\INF\msmsgs.inf,BLC.Remove.PerUser" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ "Network.ConnectionTray" = "{7007ACCF-3202-11D1-AAD2-00805FC1270E}" -> resolves to: {CLSID}\InprocServer32\(Default) = "C:\WINNT\system32\NETSHELL.dll" [MS] "WebCheck" = "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" -> resolves to: {CLSID}\InprocServer32\(Default) = ** WARNING – empty or invalid data! ** "SysTray" = "{35CEC8A3-2BE6-11D2-8773-92E220524153}" -> resolves to: {CLSID}\InprocServer32\(Default) = "stobject.dll" [MS] HKLM\System\CurrentControlSet\Control\Session Manager\ INFECTION WARNING! "BootExecute" = "DfsInit" [file not found] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ INFECTION WARNING! "PCANotify\DLLName" = "PCANotify.dll" ["Symantec Corporation"] INFECTION WARNING! "policies\DLLName" = "C:\WINNT\system32\irrol5931.dll" [null data] Startup items in "fnery" & "All Users" startup folders: ——————————————————- C:\Documents and Settings\fnery\Start Menu\Programs\Startup "Trillian" -> shortcut to: "C:\Program Files\Trillian\trillian.exe" ["Cerulean Studios"] C:\Documents and Settings\All Users\Start Menu\Programs\Startup "huipip.exe" [file not found] Enabled Scheduled Tasks: ———————— "Symantec NetDetect" -> launches: "C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE" ["Symantec Corporation"] Running Services (Display Name, Service Name, Path {Service DLL}): —————————————————————— Alerter, Alerter, "C:\WINNT\System32\services.exe" [MS] Automatic Updates, wuauserv, "C:\WINNT\system32\svchost.exe -k wugroup" {"C:\WINNT\System32\wuauserv.dll" [MS]} COM+ Event System, EventSystem, "C:\WINNT\System32\svchost.exe -k netsvcs" {"C:\WINNT\System32\es.dll" [MS]} Computer Browser, Browser, "C:\WINNT\System32\services.exe" [MS] Creative Service for CDROM Access, Creative Service for CDROM Access, "C:\WINNT\System32\CTsvcCDA.EXE" ["Creative Technology Ltd"] DHCP Client, Dhcp, "C:\WINNT\System32\services.exe" [MS] Distributed File System, Dfs, "C:\WINNT\system32\Dfssvc.exe" [MS] Distributed Link Tracking Client, TrkWks, "C:\WINNT\system32\services.exe" [MS] Distributed Transaction Coordinator, MSDTC, "C:\WINNT\System32\msdtc.exe" [MS] DNS Client, Dnscache, "C:\WINNT\System32\services.exe" [MS] Event Log, Eventlog, "C:\WINNT\system32\services.exe" [MS] GoToMyPC, GoToMyPC, ""C:\Program Files\Expertcity\GoToMyPC\g2svc.exe" -service" ["Expertcity"] IIS Admin Service, IISADMIN, "C:\WINNT\System32\inetsrv\inetinfo.exe" [MS] IPSEC Policy Agent, PolicyAgent, "C:\WINNT\System32\lsass.exe" [MS] License Logging Service, LicenseService, "C:\WINNT\System32\llssrv.exe" [MS] Logical Disk Manager, dmserver, "C:\WINNT\System32\services.exe" [MS] Messenger, Messenger, "C:\WINNT\System32\services.exe" [MS] Network Connections, Netman, "C:\WINNT\System32\svchost.exe -k netsvcs" {"C:\WINNT\System32\netman.dll" [MS]} pcAnywhere Host Service, awhost32, "C:\Program Files\Symantec\pcAnywhere\awhost32.exe" ["Symantec Corporation"] Plug and Play, PlugPlay, "C:\WINNT\system32\services.exe" [MS] Print Spooler, Spooler, "C:\WINNT\system32\spoolsv.exe" [MS] Protected Storage, ProtectedStorage, "C:\WINNT\system32\services.exe" [MS] Remote Access Connection Manager, RasMan, "C:\WINNT\System32\svchost.exe -k netsvcs" {"C:\WINNT\System32\rasmans.dll" [MS]} Remote Procedure Call (RPC), RpcSs, "C:\WINNT\system32\svchost -k rpcss" {"C:\WINNT\system32\rpcss.dll" [MS]} Remote Registry Service, RemoteRegistry, "C:\WINNT\system32\regsvc.exe" [MS] Removable Storage, NtmsSvc, "C:\WINNT\System32\svchost.exe -k netsvcs" {"C:\WINNT\System32\NtmsSvc.dll" [MS]} RunAs Service, seclogon, "C:\WINNT\system32\services.exe" [MS] Security Accounts Manager, SamSs, "C:\WINNT\system32\lsass.exe" [MS] Server, lanmanserver, "C:\WINNT\System32\services.exe" [MS] Simple Mail Transport Protocol (SMTP), SMTPSVC, "C:\WINNT\System32\inetsrv\inetinfo.exe" [MS] Still Image Service, StiSvc, "C:\WINNT\system32\stisvc.exe" [MS] System Event Notification, SENS, "C:\WINNT\system32\svchost.exe -k netsvcs" {"C:\WINNT\system32\sens.dll" [MS]} Task Scheduler, Schedule, "C:\WINNT\system32\MSTask.exe" [MS] TCP/IP NetBIOS Helper Service, LmHosts, "C:\WINNT\System32\services.exe" [MS] Telephony, TapiSrv, "C:\WINNT\System32\svchost.exe -k tapisrv" {"C:\WINNT\System32\tapisrv.dll" [MS]} Terminal Services, TermService, "C:\WINNT\System32\termsrv.exe" [MS] Windows Management Instrumentation, WinMgmt, "C:\WINNT\System32\WBEM\WinMgmt.exe" [MS] Windows Management Instrumentation Driver Extensions, Wmi, "C:\WINNT\system32\Services.exe" [MS] WMDM PMSP Service, WMDM PMSP Service, "C:\WINNT\System32\MsPMSPSv.exe" [MS] Workstation, lanmanworkstation, "C:\WINNT\System32\services.exe" [MS] World Wide Web Publishing Service, W3SVC, "C:\WINNT\System32\inetsrv\inetinfo.exe" [MS]
Post #18
Hmm.. persistent. One more try before we take a different approach.

First click here to download LSPFix. Extract the program from the zip file and run it, make sure you click the "I know what I'm doing" button. Select calsp.dll and using the right-pointing 'arrows' and move all instances of calsp.dll it mentions to the Remove (RHS) side but leave everything else (it might already be over there when you open LSPFix). Click the 'Finished' button (if you exit with the X at top right nothing happens).

Double-click on Killbox.exe to run it. In the 'Full Path of File to Delete' box, copy and paste the following, clicking the red 'Delete File' button after pasting each one:

C:\WINNT\system32\wicoco.exe
C:\WINNT\system32\irrol5931.dll
C:\Program Files\SED\SED.exe

Click 'Exit' when done.

Reboot again, rescan and post a new log together with a new Silent Runners log.
Post #19 last edited
After rebooting I got this box when starting up: RUNDLL An error occurred while trying to run ""C:\WINNT\system32\pdlmon.dll",UMonitor" Logfile of HijackThis v1.98.2 Scan saved at 3:26:19 PM, on 12/7/2004 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe c:\winnt\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\System32\termsrv.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\System32\msdtc.exe C:\Program Files\Symantec\pcAnywhere\awhost32.exe C:\WINNT\System32\CTsvcCDA.EXE C:\WINNT\System32\svchost.exe C:\Program Files\Expertcity\GoToMyPC\g2svc.exe C:\Program Files\Expertcity\GoToMyPC\g2comm.exe C:\WINNT\System32\llssrv.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\system32\stisvc.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\System32\MsPMSPSv.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\inetsrv\inetinfo.exe C:\WINNT\system32\Dfssvc.exe C:\WINNT\System32\svchost.exe C:\Program Files\Expertcity\GoToMyPC\g2tray.exe c:\winnt\system32\rundll32.exe C:\WINNT\Explorer.EXE C:\Program Files\Babylon\Babylon.exe C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe C:\Documents and Settings\All Users\Start Menu\Programs\Startup\huipip.exe C:\Program Files\Trillian\trillian.exe C:\Thanksgiving97extra\HijackThis.exe O1 - Hosts: 69.20.16.183 auto.search.msn.com O1 - Hosts: 69.20.16.183 search.netscape.com O1 - Hosts: 69.20.16.183 ieautosearch O1 - Hosts: 69.20.16.183 ieautosearch O4 - HKLM\..\Run: [PrinTray] C:\WINNT\system32\spool\DRIVERS\W32X86\2\printray.exe O4 - HKLM\..\Run: [GoToMyPC] C:\Program Files\Expertcity\GoToMyPC\g2svc.exe -logon O4 - HKCU\..\Run: [Babylon Translator] C:\Program Files\Babylon\Babylon.exe O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{314CDDDA-723C-45B2-BBE2-B55E0351E972}: NameServer = 151.203.0.84,151.203.0.85 "Silent Runners.vbs", revision 27, launched at: 15:26 Operating System: Windows 2000 Startup items buried in registry: ——————————— HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ "Babylon Translator" = "C:\Program Files\Babylon\Babylon.exe" ["Babylon Ltd."] "Creative Detector" = "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R" ["Creative Technology Ltd"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ "PrinTray" = "C:\WINNT\system32\spool\DRIVERS\W32X86\2\printray.exe" ["Lexmark"] "GoToMyPC" = "C:\Program Files\Expertcity\GoToMyPC\g2svc.exe -logon" ["Expertcity"] "Narrator" = "C:\WINNT\system32\wicoco.exe" [null data] HKLM\Software\Microsoft\Active Setup\Installed Components\ ">{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\(Default)" = "" \StubPath = "C:\WINNT\inf\unregmp2.exe /ShowWMP" [MS] "aa8740aa-536f-4f2f-8c58-d4437d45c970\(Default)" = "" \StubPath = "C:\WINNT\system32\hzamam.exe" [null data] "{5945c046-1e7d-11d1-bc44-00c04fd912be}\(Default)" = "MSN Messenger 4.6" \StubPath = "rundll32.exe advpack.dll,LaunchINFSection C:\WINNT\INF\msmsgs.inf,BLC.Remove.PerUser" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ "Network.ConnectionTray" = "{7007ACCF-3202-11D1-AAD2-00805FC1270E}" -> resolves to: {CLSID}\InprocServer32\(Default) = "C:\WINNT\system32\NETSHELL.dll" [MS] "WebCheck" = "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" -> resolves to: {CLSID}\InprocServer32\(Default) = ** WARNING – empty or invalid data! ** "SysTray" = "{35CEC8A3-2BE6-11D2-8773-92E220524153}" -> resolves to: {CLSID}\InprocServer32\(Default) = "stobject.dll" [MS] HKLM\System\CurrentControlSet\Control\Session Manager\ INFECTION WARNING! "BootExecute" = "DfsInit" [file not found] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ INFECTION WARNING! "Internet Settings\DLLName" = "C:\WINNT\system32\ktrol7931.dll" [null data] INFECTION WARNING! "PCANotify\DLLName" = "PCANotify.dll" ["Symantec Corporation"] Startup items in "fnery" & "All Users" startup folders: ——————————————————- C:\Documents and Settings\fnery\Start Menu\Programs\Startup "Trillian" -> shortcut to: "C:\Program Files\Trillian\trillian.exe" ["Cerulean Studios"] C:\Documents and Settings\All Users\Start Menu\Programs\Startup "huipip.exe" [file not found] Enabled Scheduled Tasks: ———————— "Symantec NetDetect" -> launches: "C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE" ["Symantec Corporation"] Running Services (Display Name, Service Name, Path {Service DLL}): —————————————————————— Alerter, Alerter, "C:\WINNT\System32\services.exe" [MS] Automatic Updates, wuauserv, "C:\WINNT\system32\svchost.exe -k wugroup" {"C:\WINNT\System32\wuauserv.dll" [MS]} COM+ Event System, EventSystem, "C:\WINNT\System32\svchost.exe -k netsvcs" {"C:\WINNT\System32\es.dll" [MS]} Computer Browser, Browser, "C:\WINNT\System32\services.exe" [MS] Creative Service for CDROM Access, Creative Service for CDROM Access, "C:\WINNT\System32\CTsvcCDA.EXE" ["Creative Technology Ltd"] DHCP Client, Dhcp, "C:\WINNT\System32\services.exe" [MS] Distributed File System, Dfs, "C:\WINNT\system32\Dfssvc.exe" [MS] Distributed Link Tracking Client, TrkWks, "C:\WINNT\system32\services.exe" [MS] Distributed Transaction Coordinator, MSDTC, "C:\WINNT\System32\msdtc.exe" [MS] DNS Client, Dnscache, "C:\WINNT\System32\services.exe" [MS] Event Log, Eventlog, "C:\WINNT\system32\services.exe" [MS] GoToMyPC, GoToMyPC, ""C:\Program Files\Expertcity\GoToMyPC\g2svc.exe" -service" ["Expertcity"] IIS Admin Service, IISADMIN, "C:\WINNT\System32\inetsrv\inetinfo.exe" [MS] IPSEC Policy Agent, PolicyAgent, "C:\WINNT\System32\lsass.exe" [MS] License Logging Service, LicenseService, "C:\WINNT\System32\llssrv.exe" [MS] Logical Disk Manager, dmserver, "C:\WINNT\System32\services.exe" [MS] Messenger, Messenger, "C:\WINNT\System32\services.exe" [MS] Network Connections, Netman, "C:\WINNT\System32\svchost.exe -k netsvcs" {"C:\WINNT\System32\netman.dll" [MS]} pcAnywhere Host Service, awhost32, "C:\Program Files\Symantec\pcAnywhere\awhost32.exe" ["Symantec Corporation"] Plug and Play, PlugPlay, "C:\WINNT\system32\services.exe" [MS] Print Spooler, Spooler, "C:\WINNT\system32\spoolsv.exe" [MS] Protected Storage, ProtectedStorage, "C:\WINNT\system32\services.exe" [MS] Remote Access Connection Manager, RasMan, "C:\WINNT\System32\svchost.exe -k netsvcs" {"C:\WINNT\System32\rasmans.dll" [MS]} Remote Procedure Call (RPC), RpcSs, "C:\WINNT\system32\svchost -k rpcss" {"C:\WINNT\system32\rpcss.dll" [MS]} Remote Registry Service, RemoteRegistry, "C:\WINNT\system32\regsvc.exe" [MS] Removable Storage, NtmsSvc, "C:\WINNT\System32\svchost.exe -k netsvcs" {"C:\WINNT\System32\NtmsSvc.dll" [MS]} RunAs Service, seclogon, "C:\WINNT\system32\services.exe" [MS] Security Accounts Manager, SamSs, "C:\WINNT\system32\lsass.exe" [MS] Server, lanmanserver, "C:\WINNT\System32\services.exe" [MS] Simple Mail Transport Protocol (SMTP), SMTPSVC, "C:\WINNT\System32\inetsrv\inetinfo.exe" [MS] Still Image Service, StiSvc, "C:\WINNT\system32\stisvc.exe" [MS] System Event Notification, SENS, "C:\WINNT\system32\svchost.exe -k netsvcs" {"C:\WINNT\system32\sens.dll" [MS]} Task Scheduler, Schedule, "C:\WINNT\system32\MSTask.exe" [MS] TCP/IP NetBIOS Helper Service, LmHosts, "C:\WINNT\System32\services.exe" [MS] Telephony, TapiSrv, "C:\WINNT\System32\svchost.exe -k tapisrv" {"C:\WINNT\System32\tapisrv.dll" [MS]} Terminal Services, TermService, "C:\WINNT\System32\termsrv.exe" [MS] Windows Management Instrumentation, WinMgmt, "C:\WINNT\System32\WBEM\WinMgmt.exe" [MS] Windows Management Instrumentation Driver Extensions, Wmi, "C:\WINNT\system32\Services.exe" [MS] WMDM PMSP Service, WMDM PMSP Service, "C:\WINNT\System32\MsPMSPSv.exe" [MS] Workstation, lanmanworkstation, "C:\WINNT\System32\services.exe" [MS] World Wide Web Publishing Service, W3SVC, "C:\WINNT\System32\inetsrv\inetinfo.exe" [MS]
Post #21
(thank for sticking in through…) Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. ——- System Files in System32 Directory ——- Volume in drive C has no label. Volume Serial Number is 6410-3FBD Directory of C:\WINNT\System32 12/07/2004 03:24p 224,353 pdlmon.dll 12/07/2004 03:18p 224,353 r2r60c9sef.dll 12/07/2004 06:39a 224,353 ktrol7931.dll 12/05/2004 05:51p 224,353 lvnu0959e.dll 12/05/2004 05:45p 225,151 s8rs0i97e8.dll 12/05/2004 05:42a 222,890 j2n2lc5o1f.dll 12/03/2004 01:56a dllcache 11/28/2004 12:31a 223,333 gplul3391.dll 7 File(s) 1,568,786 bytes 1 Dir(s) 2,434,154,496 bytes free ——- Hidden Files in System32 Directory ——- Volume in drive C has no label. Volume Serial Number is 6410-3FBD Directory of C:\WINNT\System32 12/05/2004 06:31a 4,212 zllictbl.dat 12/03/2004 01:56a dllcache 01/09/2001 09:11a GroupPolicy 01/08/2001 06:44p 271 desktop.ini 01/08/2001 06:44p 21,692 folder.htt 3 File(s) 26,175 bytes 2 Dir(s) 2,434,150,400 bytes free ———- Files Named "Guard" ————- Volume in drive C has no label. Volume Serial Number is 6410-3FBD Directory of C:\WINNT\System32 ——— Temp Files in System32 Directory ——– Volume in drive C has no label. Volume Serial Number is 6410-3FBD Directory of C:\WINNT\System32 04/25/2002 08:11p 109,568 SET425.tmp 03/05/2002 08:56a 582,656 SET427.tmp 03/04/2002 07:09p 548,864 SET423.tmp 12/07/1999 07:00a 2,577 CONFIG.TMP 4 File(s) 1,243,665 bytes 0 Dir(s) 2,434,150,400 bytes free —————- User Agent ———— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{737264BE-16FD-421F-BBEC-FDAC4F7C396B}"="" ———— Keys Under Notify ———— REGEDIT4 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Internet Settings] "Asynchronous"=dword:00000000 "DllName"="C:\\WINNT\\system32\\ktrol7931.dll" "Impersonate"=dword:00000000 "Logon"="WinLogon" "Logoff"="WinLogoff" "Shutdown"="WinShutdown" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\PCANotify] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "Unlock"="WLEventUnlock" "Lock"="WLEventLock" "Startup"="WLEventStartup" "DllName"="PCANotify.dll" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif] "DLLName"="wzcdlg.dll" "Logon"="WZCEventLogon" "Logoff"="WZCEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000000 —————- Xfind Results —————– C:\WINNT\System32\KTROL7~1.DLL +++ File read error ————– Locate.com Results ————— C:\WINNT\SYSTEM32\ gplul3~1.dll Sun Nov 28 2004 12:31:54a ..S.R 223,333 218.10 K j2n2lc~1.dll Sun Dec 5 2004 5:43:00a ..S.R 222,890 217.66 K ktrol7~1.dll Tue Dec 7 2004 6:39:46a ..S.R 224,353 219.09 K lvnu09~1.dll Sun Dec 5 2004 5:51:02p ..S.R 224,353 219.09 K pdlmon.dll Tue Dec 7 2004 3:24:42p ..S.R 224,353 219.09 K r2r60c~1.dll Tue Dec 7 2004 3:18:32p ..S.R 224,353 219.09 K s8rs0i~1.dll Sun Dec 5 2004 5:46:00p ..S.R 225,151 219.87 K zllictbl.dat Sun Dec 5 2004 6:31:12a …H. 4,212 4.11 K 8 items found: 8 files, 0 directories. Total of file sizes: 1,572,998 bytes 1.50 M 
Post #22 last edited
Please go to http://www.billsway.com/vbspage/ and scroll down to Registry Search Tool. Download, unzip and run RegSrch.vbs (you may need to enable your antivirus program to run the file).

Copy and paste this in the dialog box: wicoco.exe

After a while a prompt will come up. Click OK to write the results to wordpad and post them.

Repeat for this: huipip.exe

and this: hzamam.exe

Do not reboot from now on.
Post #24
ÈduardoN:
Thanks, bro. I'm gonna keep going with Daemon's train of thought for now but I really appreciate it.

Daemon:

about my Recycle Bin:
The icon on my desktop shows it full, not empty, but when I open it, I see no files. When try to empty it, it says "Are you sure you want to delete these 18 items?" When I click yes, the icon still shows full and when I try to empty it again the same thing happens again.



wicoco.exe:

REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "wicoco.exe" 12/8/2004 7:40:33 PM

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Narrator"="C:\\WINNT\\system32\\wicoco.exe"

huipip.exe:

"No instances found"


hzamam.exe:

REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "hzamam.exe" 12/8/2004 8:04:53 PM

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\aa8740aa-536f-4f2f-8c58-d4437d45c970]
"StubPath"="C:\\WINNT\\system32\\hzamam.exe"


I won't reboot until you say.
Post #25 last edited
We can fix the recycle bin later. With only HJT running, have it fix:

O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch

Click Start>Run type regedit>OK

Navigate to this key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and click it to highlight it.

In the right pane you will see a list of start-up files. Right-click Narrator and select delete.

Here's a reg fix file for the rest of it - click here to download vx2.zip. Extract vx2.reg from the zip file and save it to the desktop. When done, double click the vx2.reg and when asked to merge say yes.

Open the Killbox again, select the Delete on reboot option. In the 'Full Path of File to Delete' box, copy and paste the following, clicking the 'Delete File' button after pasting:

C:\WINNT\system32\wicoco.exe

It will prompt you to reboot, press the NO button. Instead, copy and paste the following and click the 'Delete File' button again:

C:\WINNT\system32\hzamam.exe

Repeat for the following:

C:\WINNT\system32\pdlmon.dll
C:\WINNT\system32\r2r60c9sef.dll
C:\WINNT\system32\ktrol7931.dll
C:\WINNT\system32\lvnu0959e.dll
C:\WINNT\system32\s8rs0i97e8.dll
C:\WINNT\system32\j2n2lc5o1f.dll
C:\WINNT\system32\gplul3391.dll
C:\WINNT\system32\guard.tmp

When prompted after the last one, click the YES button.

Open VX2Finder that we downloaded at the start of this, click User Agent$ to remove that entry from the registry and reboot.

Rescan with HJT, post a new log together with a new Silent Runners log and Findit log.
Post #26
Logfile of HijackThis v1.98.2 Scan saved at 1:35:35 AM, on 12/10/2004 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe c:\winnt\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\System32\termsrv.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\System32\msdtc.exe C:\Program Files\Symantec\pcAnywhere\awhost32.exe C:\WINNT\System32\CTsvcCDA.EXE C:\WINNT\System32\svchost.exe C:\Program Files\Expertcity\GoToMyPC\g2svc.exe C:\Program Files\Expertcity\GoToMyPC\g2comm.exe C:\WINNT\System32\llssrv.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\system32\stisvc.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\System32\MsPMSPSv.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\inetsrv\inetinfo.exe C:\WINNT\system32\Dfssvc.exe C:\WINNT\System32\svchost.exe C:\Program Files\Expertcity\GoToMyPC\g2tray.exe c:\winnt\system32\rundll32.exe C:\WINNT\Explorer.EXE C:\WINNT\system32\wicoco.exe C:\Program Files\Babylon\Babylon.exe C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe C:\Program Files\Trillian\trillian.exe C:\Thanksgiving97extra\HijackThis.exe O1 - Hosts: 69.20.16.183 auto.search.msn.com O1 - Hosts: 69.20.16.183 search.netscape.com O1 - Hosts: 69.20.16.183 ieautosearch O4 - HKLM\..\Run: [PrinTray] C:\WINNT\system32\spool\DRIVERS\W32X86\2\printray.exe O4 - HKLM\..\Run: [GoToMyPC] C:\Program Files\Expertcity\GoToMyPC\g2svc.exe -logon O4 - HKCU\..\Run: [Babylon Translator] C:\Program Files\Babylon\Babylon.exe O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{314CDDDA-723C-45B2-BBE2-B55E0351E972}: NameServer = 151.203.0.84,151.203.0.85 "Silent Runners.vbs", revision 27, launched at: 01:35 Operating System: Windows 2000 Startup items buried in registry: ——————————— HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ "Babylon Translator" = "C:\Program Files\Babylon\Babylon.exe" ["Babylon Ltd."] "Creative Detector" = "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R" ["Creative Technology Ltd"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ "PrinTray" = "C:\WINNT\system32\spool\DRIVERS\W32X86\2\printray.exe" ["Lexmark"] "GoToMyPC" = "C:\Program Files\Expertcity\GoToMyPC\g2svc.exe -logon" ["Expertcity"] "Narrator" = "C:\WINNT\system32\wicoco.exe" [null data] HKLM\Software\Microsoft\Active Setup\Installed Components\ ">{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\(Default)" = "" \StubPath = "C:\WINNT\inf\unregmp2.exe /ShowWMP" [MS] "aa8740aa-536f-4f2f-8c58-d4437d45c970\(Default)" = "" \StubPath = "C:\WINNT\system32\hzamam.exe" [null data] "{5945c046-1e7d-11d1-bc44-00c04fd912be}\(Default)" = "MSN Messenger 4.6" \StubPath = "rundll32.exe advpack.dll,LaunchINFSection C:\WINNT\INF\msmsgs.inf,BLC.Remove.PerUser" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ "Network.ConnectionTray" = "{7007ACCF-3202-11D1-AAD2-00805FC1270E}" -> resolves to: {CLSID}\InprocServer32\(Default) = "C:\WINNT\system32\NETSHELL.dll" [MS] "WebCheck" = "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" -> resolves to: {CLSID}\InprocServer32\(Default) = ** WARNING – empty or invalid data! ** "SysTray" = "{35CEC8A3-2BE6-11D2-8773-92E220524153}" -> resolves to: {CLSID}\InprocServer32\(Default) = "stobject.dll" [MS] HKLM\System\CurrentControlSet\Control\Session Manager\ INFECTION WARNING! "BootExecute" = "DfsInit" [file not found] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ INFECTION WARNING! "MediaContentIndex\DLLName" = "C:\WINNT\system32\j22qlcf51f2.dll" [null data] INFECTION WARNING! "PCANotify\DLLName" = "PCANotify.dll" ["Symantec Corporation"] Startup items in "fnery" & "All Users" startup folders: ——————————————————- C:\Documents and Settings\fnery\Start Menu\Programs\Startup "Trillian" -> shortcut to: "C:\Program Files\Trillian\trillian.exe" ["Cerulean Studios"] C:\Documents and Settings\All Users\Start Menu\Programs\Startup "huipip.exe" [file not found] Enabled Scheduled Tasks: ———————— "Symantec NetDetect" -> launches: "C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE" ["Symantec Corporation"] Running Services (Display Name, Service Name, Path {Service DLL}): —————————————————————— Alerter, Alerter, "C:\WINNT\System32\services.exe" [MS] Automatic Updates, wuauserv, "C:\WINNT\system32\svchost.exe -k wugroup" {"C:\WINNT\System32\wuauserv.dll" [MS]} COM+ Event System, EventSystem, "C:\WINNT\System32\svchost.exe -k netsvcs" {"C:\WINNT\System32\es.dll" [MS]} Computer Browser, Browser, "C:\WINNT\System32\services.exe" [MS] Creative Service for CDROM Access, Creative Service for CDROM Access, "C:\WINNT\System32\CTsvcCDA.EXE" ["Creative Technology Ltd"] DHCP Client, Dhcp, "C:\WINNT\System32\services.exe" [MS] Distributed File System, Dfs, "C:\WINNT\system32\Dfssvc.exe" [MS] Distributed Link Tracking Client, TrkWks, "C:\WINNT\system32\services.exe" [MS] Distributed Transaction Coordinator, MSDTC, "C:\WINNT\System32\msdtc.exe" [MS] DNS Client, Dnscache, "C:\WINNT\System32\services.exe" [MS] Event Log, Eventlog, "C:\WINNT\system32\services.exe" [MS] GoToMyPC, GoToMyPC, ""C:\Program Files\Expertcity\GoToMyPC\g2svc.exe" -service" ["Expertcity"] IIS Admin Service, IISADMIN, "C:\WINNT\System32\inetsrv\inetinfo.exe" [MS] IPSEC Policy Agent, PolicyAgent, "C:\WINNT\System32\lsass.exe" [MS] License Logging Service, LicenseService, "C:\WINNT\System32\llssrv.exe" [MS] Logical Disk Manager, dmserver, "C:\WINNT\System32\services.exe" [MS] Messenger, Messenger, "C:\WINNT\System32\services.exe" [MS] Network Connections, Netman, "C:\WINNT\System32\svchost.exe -k netsvcs" {"C:\WINNT\System32\netman.dll" [MS]} pcAnywhere Host Service, awhost32, "C:\Program Files\Symantec\pcAnywhere\awhost32.exe" ["Symantec Corporation"] Plug and Play, PlugPlay, "C:\WINNT\system32\services.exe" [MS] Print Spooler, Spooler, "C:\WINNT\system32\spoolsv.exe" [MS] Protected Storage, ProtectedStorage, "C:\WINNT\system32\services.exe" [MS] Remote Access Connection Manager, RasMan, "C:\WINNT\System32\svchost.exe -k netsvcs" {"C:\WINNT\System32\rasmans.dll" [MS]} Remote Procedure Call (RPC), RpcSs, "C:\WINNT\system32\svchost -k rpcss" {"C:\WINNT\system32\rpcss.dll" [MS]} Remote Registry Service, RemoteRegistry, "C:\WINNT\system32\regsvc.exe" [MS] Removable Storage, NtmsSvc, "C:\WINNT\System32\svchost.exe -k netsvcs" {"C:\WINNT\System32\NtmsSvc.dll" [MS]} RunAs Service, seclogon, "C:\WINNT\system32\services.exe" [MS] Security Accounts Manager, SamSs, "C:\WINNT\system32\lsass.exe" [MS] Server, lanmanserver, "C:\WINNT\System32\services.exe" [MS] Simple Mail Transport Protocol (SMTP), SMTPSVC, "C:\WINNT\System32\inetsrv\inetinfo.exe" [MS] Still Image Service, StiSvc, "C:\WINNT\system32\stisvc.exe" [MS] System Event Notification, SENS, "C:\WINNT\system32\svchost.exe -k netsvcs" {"C:\WINNT\system32\sens.dll" [MS]} Task Scheduler, Schedule, "C:\WINNT\system32\MSTask.exe" [MS] TCP/IP NetBIOS Helper Service, LmHosts, "C:\WINNT\System32\services.exe" [MS] Telephony, TapiSrv, "C:\WINNT\System32\svchost.exe -k tapisrv" {"C:\WINNT\System32\tapisrv.dll" [MS]} Terminal Services, TermService, "C:\WINNT\System32\termsrv.exe" [MS] Windows Management Instrumentation, WinMgmt, "C:\WINNT\System32\WBEM\WinMgmt.exe" [MS] Windows Management Instrumentation Driver Extensions, Wmi, "C:\WINNT\system32\Services.exe" [MS] WMDM PMSP Service, WMDM PMSP Service, "C:\WINNT\System32\MsPMSPSv.exe" [MS] Workstation, lanmanworkstation, "C:\WINNT\System32\services.exe" [MS] World Wide Web Publishing Service, W3SVC, "C:\WINNT\System32\inetsrv\inetinfo.exe" [MS]
Post #28
I can't find those two files now! :scratch: Here's log.txt C:\Thanksgiving97extra\Find_qoologic\qoologic and it also generated: win.txt C:\WINNT\system32\cwqzqz.dll: updates.qoologic.com C:\WINNT\system32\eonunu.dll: updates.qoologic.com C:\WINNT\system32\hzamam.exe: updates.qoologic.com
Post #29 last edited
Also, last time I scanned with HJT and tried to fix I got this error:

An unexpected error has occurred at procedure: modMain_FixOther1Item(sItem=O1 - Hosts: 69.20.16.183 search.netscape.com)
Error #70 - Permission denied

Please email me at [removed], reporting the following:
* What you were doing when the error occurred
* How you can reproduce the error
* A complete HijackThis scan log, if possible

Windows version: Windows NT 5.00.2195
MSIE version: 6.0.2800.1106
HijackThis version: 1.98.2

This message has been copied to your clipboard.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI